From 96fe525ef216cf2cffcd2efe168f8ab4416a379a Mon Sep 17 00:00:00 2001 From: Mazze LeCzzare Date: Sun, 26 Jul 2026 07:04:50 -0400 Subject: [PATCH] ci: skip claude-review on Dependabot PRs; SHA-pin every action MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two CI/supply-chain defects found while sweeping open Dependabot PRs. 1. claude-review failed in ~7-13s on EVERY Dependabot PR (#23,24,25,30,32). Cause: GitHub resolves `secrets.*` on a Dependabot-authored PR against the Dependabot secret store, not Actions secrets, so CLAUDE_CODE_OAUTH_TOKEN is empty and the action fails auth. Guarded the job with `if: github.actor != 'dependabot[bot]'`. The alternative — copying the token into Dependabot secrets to keep review coverage — was rejected: it widens credential surface for little signal on mechanical lockfile bumps, which `tsc` and Dependabot's advisory data already gate. Rationale recorded inline so the tradeoff stays reversible on purpose, not by accident. 2. All 13 third-party action references used MUTABLE tags (@v6/@v7/@v1/@v3). Under GUARDIAN posture a mutable tag is a supply-chain hole: the tag can be repointed at new code. Pinned every one to a full commit SHA with a trailing version comment, matching the convention codeql.yml's own header cites. Each SHA verified by dereferencing the tag object through the API. Also drops the dead commented-out author-filter block it replaced. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0172CPa6YcAjMwj6ajYDBXx1 --- .github/workflows/claude-code-review.yml | 19 ++++++++++++------- .github/workflows/claude.yml | 4 ++-- .github/workflows/codeql.yml | 6 +++--- .github/workflows/release.yml | 8 ++++---- .github/workflows/typecheck.yml | 6 +++--- 5 files changed, 24 insertions(+), 19 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index e8340e0..1a76393 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -12,11 +12,16 @@ on: jobs: claude-review: - # Optional: Filter by PR author - # if: | - # github.event.pull_request.user.login == 'external-contributor' || - # github.event.pull_request.user.login == 'new-developer' || - # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' + # Skip Dependabot PRs. GitHub resolves `secrets.*` on a Dependabot-authored + # PR against the *Dependabot* secret store, not Actions secrets, so + # CLAUDE_CODE_OAUTH_TOKEN is empty there and the job fails auth in seconds — + # a permanent red check on every dependency bump, which is noise, not signal. + # Reviewing mechanical lockfile bumps adds little over `tsc` + Dependabot's + # own advisory data. To restore review on bot PRs instead of skipping it, + # add CLAUDE_CODE_OAUTH_TOKEN to the repo's Dependabot secrets and drop + # this guard — deliberately NOT done, since duplicating a credential into a + # second store widens credential surface (GUARDIAN posture). + if: github.actor != 'dependabot[bot]' runs-on: ubuntu-latest permissions: @@ -27,13 +32,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 580e80a..a8e297f 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,13 +26,13 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index da8b70f..4d53b8a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,11 +28,11 @@ jobs: matrix: language: [javascript-typescript, actions] steps: - - uses: actions/checkout@v6 - - uses: github/codeql-action/init@v4 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} queries: security-extended - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fe627c9..20ae1e4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,18 +11,18 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 with: version: 10 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: 22 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm build - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3 with: files: dist/bundle.html generate_release_notes: true diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml index e698a88..189f58d 100644 --- a/.github/workflows/typecheck.yml +++ b/.github/workflows/typecheck.yml @@ -4,11 +4,11 @@ jobs: tsc: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 with: version: 10 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: 24 cache: pnpm